A quick guide to get Splunk Attack Range running on AWS. If you’re trying to run this locally, I would suggest having a look at this post Splunk Attack Range in a virtualized Ubuntu Guest VM. It’s a tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk. I came across this Splunk post Detecting CVE-2020-1472 and was trying to replicate this in my own environment....
I passed my Splunk Enterprise Certified Admin SPLK 1003 cert on September 11th, 2020. While I have been actively working with Splunk as part of my job, clearing the exam still requires a consistent and well-planned effort. All these points are taken from the exam blueprint: https://www.splunk.com/pdfs/training/Splunk-Test-Blueprint-Admin-v.1.1.pdf, together with either the Splunk documentation I studied for that specific part or a YouTube video I found useful. Along with these, I also bought the Udemy course The Complete Splunk Enterprise Certified Admin Course 2020...
In today’s post, we will learn how to detect a public S3 bucket using Splunk. Later, we will see how we can respond to such incidents and even prevent them from happening in the first place. As you will see in the following examples, there are multiple ways to create an S3 bucket and make it public. Also, for this blog, I created some subdomains of logsec.cloud in Route53. Scenario 1: Using the AWS Web Console Create an S3 bucket and go to “Permissions” - “Access Control List” - “Public Access” - “Everyone” - Access to the objects -...
During the past week, we detected some suspicious activities across multiple AWS accounts in one of our clients’ environments. These activities seemed related to S3 bucket scanning by a bad actor. Here is one of the sample logs from the S3 access logs: 84fd7086179626a759fb59a0252a26d26dc1685e30f0ab922266b5abace8f998 <AWS-ACCOUNT-ID>-config-org-bucket [01/Jun/2020:13:27:34 +0000] 10.247.13.187 arn:aws:iam::799199334739:user/starling-ladyblackhawk-iad-prod 9WDX6MBZFQ6Z6RDR REST.HEAD.BUCKET - "HEAD / HTTP/1.1" 403 AccessDenied 243 - 9 - "-" "AWSConfig" - wFvPfIaSbdpcnNMdcTj+BNWn00r3OfqHV8sTt8gUXMzLA7O/MiWg+NPckix2TThK15V/p1JigVc= SigV4 ECDHE-RSA-AES128-SHA AuthHeader <AWS-ACCOUNT-ID>-config-org-bucket.s3.amazonaws.com TLSv1.2 The first thing that caught our attention in this log was the username starling-ladyblackhawk-iad-prod....
In this blog post, we will learn how to ingest VPC flow logs with additional metadata into Splunk. We will start by creating a VPC flow log using Terraform and pushing the logs to S3. From S3, we will ingest these logs into Splunk using SQS. Finally, we will make some changes to Splunk’s props.conf file for correct field extraction of the additional VPC flow log fields. All Terraform files are available to download at my GitHub Repo....
This blog post will walk you through setting up a Splunk environment on AWS for lab purposes using the Splunk Enterprise Free 60-day trial. After 60 days you can convert to a perpetual free license or purchase a Splunk Enterprise license to continue using the expanded functionality designed for enterprise-scale deployments. There is an indexing limit of 500 MB/Day which will be more than enough for our demo purposes. There are multiple ways to accomplish this - using the AWS Console, the CLI or CloudFormation....